@memoarchitect/ontology 0.7.0 → 0.8.24

package/src/assurance/requirements/memo_requirements.sysml

@@ -7,22 +7,6 @@ package memo_assurance_requirements {
     private import memo_assurance_requirements_needs::*;
     part def RiskDriver specializes RequirementDriver { attribute driverKind : String; }
 
-    // ISO 14971 risk-analysis inputs. These are model elements so hazards,
-    // scenarios, requirements, and DHF records can trace to the exact use
-    // definition or foreseeable misuse that motivated them.
-    part def IntendedUse specializes DocumentedElement {
-        attribute indication : String;
-        attribute contraindication : String;
-        attribute patientPopulation : String;
-        attribute clinicalBenefit : String;
-        attribute regulatoryClassification : String;
-    }
-    part def ReasonablyForeseeableMisuse specializes DocumentedElement {
-        attribute misuseContext : String;
-        attribute foreseeableBasis : String;
-        attribute affectedUseContext : String;
-    }
-
     // The kind of requirement. Was a subclass branch (SystemRequirement /
     // SoftwareRequirement / HardwareRequirement) plus a parallel design-control
     // specification hierarchy (DesignControlSpecification / System- / Software- /
@@ -40,13 +24,16 @@ package memo_assurance_requirements {
         enum designControl;
     }
 
-    requirement def Requirement specializes VerifiableElement {
+    requirement def Requirement specializes MemoRequirement {
         attribute requirementKind : RequirementKind;
-        attribute statement : String;
+        attribute :>> statement : String;
         attribute sourceKind : RequirementSourceKind;
         attribute concernKind : ConcernKind;
-        attribute requirementStatus : RequirementStatusKind;
-        attribute acceptanceCriteria : String;
+        // Editorial state is the inherited `status : ElementStatusKind` — the
+        // one status vocabulary in MEMO. Whether a requirement is implemented,
+        // verified, or validated is read from its Realizes / VerifiedBy /
+        // Validates links, not restated here.
+        attribute :>> acceptanceCriteria : String;
         attribute subjectDescription : String;
         attribute actorDescription : String;
         attribute assumptionSummary : String;

package/src/assurance/requirements/needs/memo_needs.sysml

@@ -27,7 +27,7 @@ package memo_assurance_requirements_needs {
         enum designControl;
     }
 
-    requirement def Need specializes MemoNeed, RequirementDriver {
+    requirement def Need specializes MemoNeed {
         attribute needKind : NeedKind;
         // user need (IEC 62366-1)
         attribute userPopulationReference : String;

package/src/assurance/safety_risk/analysis/memo_fmea.sysml

@@ -1,37 +1,57 @@
 package memo_assurance_safety_risk_analysis {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
+    private import memo_core_relationships::*;   // MemoRelationship
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
-    item def FMEAWorksheet specializes AnalysisArtifact {
+    private import memo_assurance_safety_risk::*;   // RiskItem
+    part def FMEAWorksheet specializes AnalysisArtifact {
         attribute analysisScope : String;
         attribute standardReference : String;
         attribute analysisBasis : String;
         attribute revisionDate : String;
         attribute reviewer : String;
     }
-    item def FailureMode specializes MemoPart {
+    // An FMEA worksheet row states, on one line, what fails, what that does,
+    // how likely it is, and what controls it. The RPN triple carries the
+    // *scoring*; `effect` and `probability` carry the two facts a reader of the
+    // row needs in words. They are summaries, not replacements: the modelled
+    // form of an effect is a FailureEffect linked by Causes, and the modelled
+    // form of a control is a RiskControlMeasure linked by
+    // Mitigates(mitigationKind = failureMode) — traversable as
+    // `traverse: incoming mitigates`. MEMO deliberately does not add a second
+    // failure-mode-to-control relation; one whole/part and one mitigation
+    // relation is the lean shape the rest of the ontology already uses.
+    item def FailureMode specializes RiskItem {
         attribute failureModeKind : FailureModeKind;
+        doc /* One-line statement of what this failure does, for the worksheet
+             * row. The structured form is a FailureEffect. */
+        attribute effect : String[0..1];
         attribute severityRating : Integer;
+        doc /* Qualitative likelihood, the ISO 14971 register. `occurrenceRating`
+             * is the same fact as an FMEA score; both are kept because an FMEA
+             * reports the score and a risk file reports the qualitative band. */
+        attribute probability : ProbabilityKind[0..1];
         attribute occurrenceRating : Integer;
         attribute detectionRating : Integer;
         attribute rpn : Integer;
         attribute criticality : CriticalityKind;
     }
-    item def FailureEffect specializes MemoPart {
+    item def FailureEffect specializes RiskItem {
         attribute effectLevel : FailureEffectLevelKind;
         attribute effectOnPatient : String;
         attribute effectOnOperator : String;
         attribute effectOnSystem : String;
         attribute severity : SeverityKind;
     }
-    item def FailureCause specializes MemoPart {
+    item def FailureCause specializes RiskItem {
         attribute causeCategory : FailureCauseCategoryKind;
         attribute causeDescription : String;
         attribute occurrenceRating : ProbabilityKind;
         attribute preventionMethod : String;
     }
-    item def DetectionMethod specializes MemoPart {
+    part def DetectionMethod specializes MemoPart {
         attribute methodKind : DetectionMethodKind;
         attribute detectionPoint : String;
         attribute confidence : DetectionKind;
@@ -42,43 +62,41 @@ package memo_assurance_safety_risk_analysis {
         attribute targetCompletionDate : String;
         attribute revisedRpn : Integer;
     }
-    item def FaultTree specializes AnalysisArtifact {
+    part def FaultTree specializes AnalysisArtifact {
         attribute standardReference : String;
         attribute analysisScope : String;
         attribute topEventDescription : String;
         attribute cutSetSummary : String;
         attribute revisionDate : String;
     }
-    item def FaultTreeEvent specializes MemoPart {
+    part def FaultTreeNode specializes MemoPart {
         attribute eventKind : FaultTreeEventKind;
         attribute probability : Real;
         attribute failureRate : Real;
         attribute exposureTime : Real;
         attribute :>> description : String;
-    }
-    item def FaultTreeGate specializes MemoPart {
         attribute gateKind : FaultTreeGateKind;
         attribute kValue : Integer;
         attribute nValue : Integer;
     }
-    item def MinimalCutSet specializes MemoPart {
+    item def MinimalCutSet specializes RiskItem {
         attribute cutSetOrder : Integer;
         attribute probability : Real;
         attribute involvedEvents : String;
         attribute significance : String;
     }
-    item def HAZOPStudy specializes AnalysisArtifact {
+    part def HAZOPStudy specializes AnalysisArtifact {
         attribute standardReference : String;
         attribute processDescription : String;
         attribute studyScope : String;
         attribute teamComposition : String;
     }
-    item def HAZOPNode specializes MemoPart {
+    part def HAZOPNode specializes MemoPart {
         attribute nodeDescription : String;
         attribute designIntent : String;
         attribute operatingConditions : String;
     }
-    item def HAZOPDeviation specializes MemoPart {
+    item def HAZOPDeviation specializes RiskItem {
         attribute guideWord : HAZOPGuideWordKind;
         attribute parameter : String;
         attribute cause : String;
@@ -88,4 +106,91 @@ package memo_assurance_safety_risk_analysis {
         attribute likelihood : ProbabilityKind;
         attribute recommendation : String;
     }
+
+    // ── Relations owned by this package ─────────────────────────────
+    // Moved out of memo_core_relationships: their ends are typed against
+    // types declared here, and core must not depend on a domain package.
+    // Causes unifies the former causal edges of the ISO 14971 / FMEA / FTA
+    // chains — CausesEffect, CausedBy, ContributesToHazard, LeadsToHazard,
+    // OriginatesFrom, UseErrorLeadsToHazard — keyed by causeKind. cause is the
+    // originating element, effect the consequence.
+    enum def CauseKind {
+        enum failureCausesEffect;
+        enum failureCausedBy;
+        enum contributesToHazard;
+        enum leadsToHazard;
+        enum originatesFrom;
+        enum useErrorLeadsToHazard;
+    }
+    connection def Causes :> MemoRelationship {
+        attribute causeKind : CauseKind;
+        end cause : MemoPart :>> source;
+        end effect : RiskItem :>> target;
+    }
+    abstract connection causesLinks : Causes[*];
+    metadata def <causes> CausesMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = causesLinks meta SysML::Usage;
+    }
+    connection def DetectedBy :> MemoRelationship {
+        end failureMode : FailureMode :>> source;
+        end detectionMethod : DetectionMethod :>> target;
+    }
+    abstract connection detectedByLinks : DetectedBy[*];
+    metadata def <detectedBy> DetectedByMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = detectedByLinks meta SysML::Usage;
+    }
+    connection def InputToGate :> MemoRelationship {
+        end input : FaultTreeNode :>> source;
+        end gate : FaultTreeNode :>> target;
+    }
+    abstract connection inputToGateLinks : InputToGate[*];
+    metadata def <inputToGate> InputToGateMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = inputToGateLinks meta SysML::Usage;
+    }
+    connection def ProducesEvent :> MemoRelationship {
+        end gate : FaultTreeNode :>> source;
+        end eventElement : FaultTreeNode :>> target;
+    }
+    abstract connection producesEventLinks : ProducesEvent[*];
+    metadata def <producesEvent> ProducesEventMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = producesEventLinks meta SysML::Usage;
+    }
+    connection def ContainsEvent :> MemoRelationship {
+        end cutSet : MinimalCutSet :>> source;
+        end eventElement : FaultTreeNode :>> target;
+    }
+    abstract connection containsEventLinks : ContainsEvent[*];
+    metadata def <containsEvent> ContainsEventMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = containsEventLinks meta SysML::Usage;
+    }
+    connection def IdentifiesHazard :> MemoRelationship {
+        end deviation : HAZOPDeviation :>> source;
+        end hazard : Hazard :>> target;
+    }
+    abstract connection identifiesHazardLinks : IdentifiesHazard[*];
+    metadata def <identifiesHazard> IdentifiesHazardMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = identifiesHazardLinks meta SysML::Usage;
+    }
+    connection def HasFailureMode :> MemoRelationship {
+        end element : MemoPart :>> source;
+        end failureMode : FailureMode :>> target;
+    }
+    abstract connection hasFailureModeLinks : HasFailureMode[*];
+    metadata def <hasFailureMode> HasFailureModeMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = hasFailureModeLinks meta SysML::Usage;
+    }
 }

package/src/assurance/safety_risk/memo_risk.sysml

@@ -1,9 +1,23 @@
 package memo_assurance_safety_risk {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
+    private import memo_core_relationships::*;   // MemoRelationship
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
     private import memo_assurance_requirements::*;
+
+    // ISO 14971 / IEC 62366-1 risk-analysis input. A model element so hazards,
+    // scenarios, requirements, and DHF records can trace to the foreseeable
+    // misuse that motivated them. Its counterpart, IntendedUse, is now the
+    // operational-world root (memo_architecture_operational_structure::IntendedUse,
+    // a MemoMission).
+    part def ReasonablyForeseeableMisuse specializes MemoPart {
+        attribute misuseContext : String;
+        attribute foreseeableBasis : String;
+        attribute affectedUseContext : String;
+    }
+
     part def Risk specializes RiskDriver {
         attribute probabilityEstimate : ProbabilityKind;
         attribute severityEstimate : SeverityKind;
@@ -46,32 +60,52 @@ package memo_assurance_safety_risk {
         attribute normalUseRelevant : Boolean;
         attribute faultConditionRelevant : Boolean;
     }
-    item def Hazard specializes MemoPart {
+    // ─── Risk-element base ──────────────────────────────────────────
+    // The common supertype of the item-based elements an ISO 14971 / FMEA /
+    // FTA chain relates: hazards, sequences of events, hazardous situations,
+    // harms, causes, failure modes, fault-tree events, cut sets, HAZOP
+    // deviations, vulnerabilities.
+    //
+    // It exists so the risk relations can TYPE their ends. Before it, every
+    // one of them (Causes, TracesRisk, DetectedBy, InputToGate, ProducesEvent,
+    // ContainsEvent, IdentifiesHazard, Mitigates, ImpactsSafety) fell back to
+    // MemoPart — which every element in MEMO is — so the authoring picker
+    // offered fault-tree edges when linking a screen to a requirement.
+    //
+    // It is deliberately an `item def` and deliberately does NOT cover Risk /
+    // ResidualRisk / RiskMatrix, which are parts: a risk is an assessed
+    // judgement about a chain, not a link in it, and it is reached by
+    // AssessedAgainst instead. One base per metaclass is the right shape here
+    // — forcing the two families under one supertype would put a hazard and a
+    // risk matrix back in the same picker.
+    abstract item def RiskItem specializes MemoItem;
+
+    item def Hazard specializes RiskItem {
         attribute hazardType : HazardTypeKind;
         attribute severity : SeverityKind;
         attribute foreseeable : Boolean;
     }
-    item def SequenceOfEvents specializes MemoPart {
+    item def SequenceOfEvents specializes RiskItem {
         attribute initiatingEvent : String;
         attribute contributingFactors : String;
     }
     // A categorized root cause in a hazard causal tree (FDA GIIP
     // taxonomy pattern: cause -> hazard -> hazardous situation -> harm;
     // several HazardCause elements may converge on one Hazard).
-    item def HazardCause specializes MemoPart {
+    item def HazardCause specializes RiskItem {
         attribute causeSource : CauseSourceKind;
         attribute contributingFactors : String;
     }
-    item def HazardousSituation specializes MemoPart {
+    item def HazardousSituation specializes RiskItem {
         attribute exposedPersons : String;
         attribute operatingCondition : String;
     }
-    item def Harm specializes MemoPart {
+    item def Harm specializes RiskItem {
         attribute clinicalImpact : String;
         attribute reversibility : String;
         attribute severity : SeverityKind;
     }
-    item def RiskControlMeasure specializes VerifiableElement {
+    part def RiskControlMeasure specializes VerifiableElement {
         attribute controlKind : RiskControlKind;
         attribute implementationKind : RiskControlImplementationKind;
         attribute verificationStatus : String;
@@ -82,8 +116,57 @@ package memo_assurance_safety_risk {
         attribute clinicalSignificance : String;
         attribute supportingEvidence : String;
     }
-    item def OverallResidualRiskEvaluation specializes MemoPart {
+    part def OverallResidualRiskEvaluation specializes MemoPart {
         attribute conclusion : String;
         attribute reviewer : String;
     }
+
+    // ── Relations owned by this package ─────────────────────────────
+    // Moved out of memo_core_relationships: their ends are typed against
+    // types declared here, and core must not depend on a domain package.
+    // ISO 14971 risk chain — distinct sequence-of-events relations over risk elements.
+    connection def TracesRisk :> MemoRelationship {
+        end sourceRiskElement : RiskItem :>> source;
+        end targetRiskElement : RiskItem :>> target;
+    }
+    abstract connection tracesRiskLinks : TracesRisk[*];
+    metadata def <tracesRisk> TracesRiskMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = tracesRiskLinks meta SysML::Usage;
+    }
+    connection def AssessedAgainst :> MemoRelationship {
+        end risk : Risk :>> source;
+        end riskMatrix : RiskMatrix :>> target;
+    }
+    abstract connection assessedAgainstLinks : AssessedAgainst[*];
+    metadata def <assessedAgainst> AssessedAgainstMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = assessedAgainstLinks meta SysML::Usage;
+    }
+    // Mitigates unifies the control/action → risk-element edges of the
+    // ISO 14971 / FMEA / FTA / cyber chains — MitigatesHazard,
+    // MitigatesVulnerability, MitigatedByControl, BrokenByControl,
+    // AddressedByAction — keyed by mitigationKind. control is the mitigating
+    // control/action; mitigatedElement is the hazard/vulnerability/failure/cut set.
+    enum def MitigationKind {
+        enum hazard;
+        enum vulnerability;
+        enum failureMode;
+        enum cutSet;
+        enum fmeaAction;
+    }
+    connection def Mitigates :> MemoRelationship {
+        attribute mitigationKind : MitigationKind;
+        // Untyped: controls/hazards may be item defs (RiskControlMeasure, Hazard, …).
+        end control :>> source;
+        end mitigatedElement : RiskItem :>> target;
+    }
+    abstract connection mitigatesLinks : Mitigates[*];
+    metadata def <mitigates> MitigatesMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = mitigatesLinks meta SysML::Usage;
+    }
 }

package/src/assurance/safety_risk/postmarket_surveillance/memo_postmarket_surveillance.sysml

@@ -1,5 +1,7 @@
 package memo_assurance_safety_risk_postmarket_surveillance {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
+    private import memo_core_relationships::*;   // MemoRelationship
 
     private import memo_core_common::*;
 
@@ -8,4 +10,18 @@ package memo_assurance_safety_risk_postmarket_surveillance {
         attribute dataSource : String;
         attribute reportingObligation : String;
     }
+
+    // ── Relations owned by this package ─────────────────────────────
+    // Moved out of memo_core_relationships: their ends are typed against
+    // types declared here, and core must not depend on a domain package.
+    connection def FeedsBackTo :> MemoRelationship {
+        end feedbackItem : PostMarketSurveillance :>> source;
+        end designElement : MemoPart :>> target;
+    }
+    abstract connection feedsBackToLinks : FeedsBackTo[*];
+    metadata def <feedsBackTo> FeedsBackToMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = feedsBackToLinks meta SysML::Usage;
+    }
 }

package/src/assurance/verification_validation/memo_assurance.sysml

@@ -1,4 +1,5 @@
 package memo_assurance_verification_validation {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -10,10 +11,17 @@ package memo_assurance_verification_validation {
     // Verification and validation cases are SysML v2 verification cases
     // (behaviours that check requirements), not verifiable structures — they
     // derive from the MemoVerificationCase foundation, not MemoPart.
+    // `status` is NOT redeclared here. It used to be re-declared as a String,
+    // which shadowed the `status : ElementStatusKind` every MEMO base carries
+    // and let a verification case hold an editorial status no other element
+    // could hold — against the "one status vocabulary in MEMO" rule stated in
+    // memo_requirements.sysml. The values it actually held ("planned") were an
+    // EXECUTION state, not an editorial one; execution state belongs in an
+    // attribute of its own (see RiskControlMeasure.verificationStatus), not in
+    // a second spelling of `status`.
     verification def VerificationCase :> MemoVerificationCase {
         attribute methodKind : VerificationMethodKind;
         attribute acceptanceCriteria : String;
-        attribute status : String;
     }
     verification def ValidationCase :> MemoVerificationCase {
         attribute validationMethod : ValidationMethodKind;
@@ -21,29 +29,17 @@ package memo_assurance_verification_validation {
         attribute acceptanceCriteria : String;
         attribute clinicalContext : String;
     }
-    part def TestArtifact specializes MemoEvidence {
-        attribute version : String;
-        attribute artifactKind : ArtifactKind;
-        attribute resultSummary : String;
-    }
-    part def Evidence specializes MemoEvidence {
-        attribute version : String;
-        attribute evidenceType : String;
-        attribute integrityStatus : String;
-    }
-
-    // A scenario executed to verify — selected path with purpose
-    // 'verification'.
-    action def VerificationScenario specializes MemoScenario {
-        attribute verificationEnvironment : String;
-        attribute stimulusSummary : String;
-    }
-
     // Operational validation confirms the user's goal is achieved in the
     // use environment (§5): ValidationCase validates a UseCase.
     // Safety-critical functions must trace to verification (rules/coverage).
     connection def ExecutesScenario :> MemoRelationship {
-        end verificationCase : VerificationCase;
-        end scenario : MemoScenario;
+        end verificationCase : VerificationCase :>> source;
+        end scenario : OperativeScenario :>> target;
+    }
+    abstract connection executesScenarioLinks : ExecutesScenario[*];
+    metadata def <executesScenario> ExecutesScenarioMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = executesScenarioLinks meta SysML::Usage;
     }
 }

package/src/core/annotations/memo_annotations.sysml

@@ -14,6 +14,7 @@
 // NotesOn leave their subject ends untyped, following the MemoLink precedent in
 // memo_core_relationships.
 package memo_core_annotations {
+    private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
 
     private import memo_core_common::*;
@@ -61,17 +62,35 @@ package memo_core_annotations {
     // The end is `remark`, not `comment`: `comment` is a reserved KerML
     // keyword and cannot name a feature.
     connection def CommentsOn :> MemoRelationship {
-        end remark : ModelComment;
-        end annotatedElement;
+        end remark : ModelComment :>> source;
+        end annotatedElement :>> target;
+    }
+    abstract connection commentsOnLinks : CommentsOn[*];
+    metadata def <commentsOn> CommentsOnMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = commentsOnLinks meta SysML::Usage;
     }
 
     connection def RationaleFor :> MemoRelationship {
-        end rationaleRecord : ModelRationale;
-        end justifiedElement;
+        end rationaleRecord : ModelRationale :>> source;
+        end justifiedElement :>> target;
+    }
+    abstract connection rationaleForLinks : RationaleFor[*];
+    metadata def <rationaleFor> RationaleForMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = rationaleForLinks meta SysML::Usage;
     }
 
     connection def NotesOn :> MemoRelationship {
-        end noteRecord : ModelNote;
-        end notedElement;
+        end noteRecord : ModelNote :>> source;
+        end notedElement :>> target;
+    }
+    abstract connection notesOnLinks : NotesOn[*];
+    metadata def <notesOn> NotesOnMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = notesOnLinks meta SysML::Usage;
     }
 }